JVN#97656108: WordPress plugin "Smart Forms" vulnerable to cross-site request forgery

The WordPress plugin “Smart Forms” provided by RedNao contains a cross-site request forgery vulnerability (CWE-352).

Impact

Unintended operations may be performed if a user logs into the WordPress administration screen and browses a malicious page.
Those operations may include generating new forms, inserting JavaScript code to existing forms, and deleting existing forms.

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

• Smart Forms 2.6.15 and earlier